With a custodial lightning wallet you choose who to trust. When you receive a cashu as payment you are forced to trust the sender's mint. If you have internet access, you should immediately move it (via lightning) to the mint you trust. If you don't or can't, you invite rugging. That's why I will never accept cashu payments offline...